CVE-2017-9228: Critical severity PHP PHP vulnerability
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Other sources
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitsetsetrange() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parsecharclass() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption. Upstream bug:
https://github.com/kkos/oniguruma/issues/60
Upstream patch:
https://github.com/kkos/oniguruma/commit/3b63d12038c8d8fc278e81c942fa9bec7c704c8b
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php70-phpto a version that resolves this vulnerability.Fixed in 0:7.0.27-1.el6 - Upgrade
Upgrade
redhat/rh-php70-phpto a version that resolves this vulnerability.Fixed in 0:7.0.27-1.el7 - Upgrade
Upgrade
redhat/onigurumato a version that resolves this vulnerability.Fixed in 6.3.0 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.6.31 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.0.21 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
debian/libonigto a version that resolves this vulnerability.Fixed in 6.9.6-1.1Fixed in 6.9.8-1Fixed in 6.9.9-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.0.21 - Upgrade
Upgrade
alpine/php5to a version that resolves this vulnerability.Fixed in 5.6.31-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.0.21-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.1.9-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.1.7-r0 - Upgrade
Upgrade
onigurumato a version that resolves this vulnerability.Patch 3b63d12038c8d8fc278e81c942fa9bec7c704c8b
Event History
Frequently Asked Questions
What is CVE-2017-9228?
CVE-2017-9228 is a vulnerability in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.
How severe is CVE-2017-9228?
CVE-2017-9228 has a severity rating of 9.8 (critical).
What is the impact of CVE-2017-9228?
CVE-2017-9228 allows for a heap out-of-bounds write during regular expression compilation, which can lead to code execution or denial of service.
How can I fix CVE-2017-9228?
To fix CVE-2017-9228, update Oniguruma to version 6.3.0 or higher.
Where can I find more information about CVE-2017-9228?
You can find more information about CVE-2017-9228 at the following references: [1](https://github.com/kkos/oniguruma/issues/60), [2](https://github.com/kkos/oniguruma/commit/3b63d12038c8d8fc278e81c942fa9bec7c704c8b), [3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1466750).